COVID Key Developments: July 3-17

Government Responses:

Countries across the world continue to weigh the most appropriate ways to reopen economies and borders while also striving to minimize spikes in new cases.
EU leaders met on June 17 to initiate discussions on an aid package to help the member states begin recovery efforts. This was the first in-person meeting of the bloc’s leaders since the beginning of the pandemic. The proposed package will reportedly include 1.8 trillion euros in funding which will be allocated over the next seven years, with 750 billion euros set aside for a pandemic recovery fund.
Countries continue to evaluate how to ease border restrictions, and which foreigners may begin to travel to their countries. Canada extended its border ban for nonessential travel by US citizens until August 21, and the EU announced on July 16 that its ban on US travelers will remain in place as well.
Across the US, state governments are taking multiple approaches to reopening the economy. Many states are increasingly issuing mandatory mask requirements in public in an effort to stanch the rising number of cases across the majority of the country. Alternatively, a handful of states such as in Georgia, are placing prohibitions on local governments’ ability to implement mandates to wear masks. Some officials, including the Georgia governor, have cited a difficulty to reasonably enforce such measures, and the continued spread of misinformation about mask wearing (detailed below) has politicized the issue.
The US Government released reporting about what organizations received Paycheck Protection Program funding. Congress is also continuing to discuss a second coronavirus funding relief bill, which is expected to progress once it returns from recess next week.

Medical Research Developments:

Researchers across the world continue to pursue development of a vaccine against the coronavirus.
Researchers at Monash University in Australia have reported a new blood test that can detect coronavirus in twenty minutes. They have indicated this test can not only determine if someone is currently infected, but also if they have been infected in the past.
Moderna announced that its experimental vaccine had positive results in a clinical trial of 45 participants. According to the pharmaceutical company, the vaccine produced an immune response in every test subject, and it has been lauded as a positive step towards developing a vaccine against the coronavirus.
Although the World Health Organization (WHO) guidance reports that the disease is primarily transmitted from person-to-person interaction, hundreds of scientists signed a letter asking the agency to revise this guidance. According to the open letter, there is evidence to suggest that the disease is also airborne and can infect individuals who inhale air infected with droplets of the virus.

Cybercrime and Coronavirus:

Flashpoint analysts continue to track ways in which threat actors in illicit communities are exploiting issues related to the pandemic for fraudulent purposes.
On July 16th, 2020 the National Cyber Security Centre (NCSC) released an advisory detailing the latest tactics, techniques, and procedures (TTPs) used by Russian-intelligence linked threat actor group APT29 (aka “Cozy Bear”, “Dukes”). The report details the usage of previously unattributed custom malware “WellMess” and “WellMail” to target a number of organizations globally, including those involved in COVID-19 vaccine research.
Microsoft obtained a court order this month allowing the company to seize control of six domains that were used in phishing operations against Office 365 customers, including in campaigns that leveraged COVID-19 lures.
Actors continue to exploit unemployment programs and SBA loans, including the following examples observed by Flashpoint analysts:

• An English-speaking threat actor posted a tutorial on the information needed to fraudulently file for unemployment. They also share states where applications are currently going through, and states to avoid. They also include some step-by-step instructions and warn that Movo can no longer be used for California, as that state sends a card to the physical address tied to the individual.
• An English-speaking threat actor posted an image in a popular chat service channel that contained a list of the states that are continuing to provide pandemic unemployment assistance. They included links to the application sites, as well as the minimum and maximum payouts for these states. The list also included those states that are no longer providing such assistance, and which states can “get you in trouble” because they are tracking applications.
• An English-speaking threat actor posted multiple images in a chat service channel showing them allegedly assisting another individual in fraudulently obtaining an SBA loan. Other users criticized the images, which appear to show that individual used a personal account to cash out the funds (which they imply is a poor decision because it would be flagged for fraud), but the actor claims that they “do credit in real life and got a financing business” and use the same methods for criminal and legitimate business purposes.
• An English-speaking threat actor posted on a popular forum that they are seeking to purchase Emotet, Trickbot, or a similar malware that they wish to use to infect/spread ransomware. In the title of their thread, they claim this is for “coronavirus ransomware” but do not provide additional details about how they intend to exploit the coronavirus in their campaign.

Misinformation and Disinformation Narratives:

Misinformation and disinformation about COVID-19 continues to spread on social media platforms and via chat services. Narratives and major developments observed by Flashpoint analysts include efforts to politicize the virus:

• QAnon conspiracy theorists continued to target Dr. Fauci, Bill Gates, and others, accusing them of leading a deep-state operation to undermine the Trump administration. A viral image on Facebook showing former President Obama visiting an NIH lab with Dr. Fauci was captioned, “Dr. Fauci, Melinda Gates, and Barack Obama at the Wuhan Lab in 2015… where they paid the lab 3.7 million for a ‘bat’ project.”
• Others claimed that the sharp rise in COVID-19 cases in the US is fabricated to “unseat a President in November.” 
• The Trump administration has made false claims that infection figures in the US are artificially inflated because there is too much testing.

Misinformation continued to spread about virus-containment measures, including masks, testing, and social distancing:

• Conspiracy theories claimed that the metal nose piece in surgical masks is actually a 5G antenna, and that COVID-19 test swabs are taken from the nasal passages because they are being used to “implant something.” Conspiracy theorists could not agree whether the swabs are implanting microchips or “seeding” the virus.
• False information that the World Health Organization (WHO) no longer recommends social distancing spread via a screenshotted tweet, particularly in Canada and South Africa.
• The debate on reopening US schools in the fall continued, with false and misleading claims on both sides. These include whether young people under the age of twenty can contract or transmit COVID-19 (they can), whether Secretary of Education Betsy DeVos claimed that “only” 0.2% of kids would die if schools are reopened (she didn’t), and that books were removed from a middle school because they were carrying the coronavirus (they weren’t). These dissonances reflect anxieties over the childcare needs of working parents.
• Meanwhile, Chinese and pro-Kremlin disinformation efforts converged into an overlapping conspiracy theory claiming that the US “has deployed more than 200 military biological laboratories across the world.”